Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-1428
HistoryJun 09, 2023 - 12:00 a.m.

CVE-2023-1428

2023-06-0900:00:00
ubuntu.com
ubuntu.com
15
vulnerability
grpc
abort()unix
http2
header size

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

34.8%

There exists an vulnerability causing an abort() to be called in gRPC. The
following headers cause gRPC’s C++ implementation to abort() when called
via http2: te: x (x != trailers) :scheme: x (x != http, https)
grpclb_client_stats: x (x == anything) On top of sending one of those
headers, a later header must be sent that gets the total header size past
8KB. We recommend upgrading past git commit
2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

34.8%